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I. INTRODUCTION 

Quantum key distribution (QKD) P, Q is a technique 
that allows two parties, typically called Alice and Bob, 
to generate an unconditionally secure secret key. This 
secret key can then be used together with the Vernam 
cipher 3] to achieve unconditionally secure communica- 
tions against any possible eavesdropper, named Eve. 

Typical practical QKD protocols distinguish two 
phases in order to generate a secret key. In the first 
phase, an effective bipartite quantum state is distributed 
between Alice and Bob. This state creates correlations 
between them and it might contain as well hidden corre- 
lations with Eve. Next, Alice and Bob perform a set of 
measurements on the given signal states in order to mea- 
sure these correlations. As a result, they obtain a joint 
probability distribution p{ai,bj) = pij describing their 
classical outcomes. In the second phase, Alice and Bob 
try to distill a secret key from these correlated data pij by 
means of public discussions over an authenticated clas- 
sical channel. This procedure includes postselection of 
data, error correction to reconcile the data, and privacy 
amplification to decouple the data from Eve 0. In this 
second phase, no quantum-mechanical manipulations are 
performed; it is a completely classical process. 

Two types of schemes are used to create the correlated 
data in the first phase of QKD. In entanglement-based 
(EB) schemes, a source, which is assumed to be under 
Eve's control, produces a bipartite quantum state pab 
that is distributed to AHce and Bob. Eve could even 
have a third system entangled with those given to the 
legitimate users. Alice and Bob measure each incoming 
signal by means of two positive operator valued measures 
(POVM) {Ai} and {Bj}, respectively. While the subsys- 
tems measured by Alice and Bob result in correlations 
described by a joint probability distribution pij, Eve can 
use her subsystem to obtain information about the data 
of the legitimate users. 

In prepare and measure (PM) schemes, Alice prepares a 
state \ipi) with probability and sends it to Bob. On the 
receiving side. Bob measures each received signal with a 



POVM described by the quantum operators {Bj}. Gen- 
eralizing the ideas introduced by Bennett et al. 0, the 
signal preparation process in PM schemes can be thought 
of as follows: Alice produces first the bipartite quantum 

state \iisource)AB = Hi \/PiWi) A\^i) B ^'^'^^ afterward, 
she measures the first subsystem in the orthogonal basis 
|ai)^. This action generates the (nonorthogonal) signal 
states \ipi) with probabilities pi. It is important to note 
that in PM schemes, the reduced density matrix of Al- 
ice, PA = TrB(|'0so«rce)AB(V'sotirce|), is fixed and cannot 
be modified by Eve. The state pA depends only on the 
probabilities pi and on the overlap of the signals states 
\^Pi). This information is known to all the parties. To 
include it in the measurement process one can add to the 
observables {Ai (g) Bj} measured by Alice and Bob other 
observables {Cfe(8)l} such that the observables {Cfc} form 
a tomographically complete set of Alice's Hilbert space 
@ 

From now on, we will always use the term entangle- 
ment and detection devices without making any further 
distinction between these two different QKD schemes. 
Moreover, pij and {Ai (g) Bj{ refer to the complete set 
of measurements, i.e., they include also the observables 
{Cfc (g) 1} for PM schemes. 

An essential question in QKD is whether the corre- 
lated data contained in pij allow Alice and Bob to gen- 
erate a secret key. In Ref. , it has been proven that a 
necessary precondition for secure key distribution is the 
provable presence of quantum correlations in . In this 
context, see also Ref. Given the set of measurements 
performed by Alice and Bob together with the resulting 
probabilities p.y, the legitimate users can calculate the 
equivalence class S of quantum states that are compati- 
ble with the observed data pij : 

S = {pAB I Tr(A, (g) Bj pab) = Pio, Vi, j} . (1) 

By definition, every state pab S S can represent the state 
shared by Alice and Bob before their measurements |^. 
According to Ref. 0, in order to be able to distill a se- 
cret key from the observed data, it is necessary to prove 
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that the equivalence class S does not contain any sepa- 
rable state. See also Ref. . This task is called effective 
entanglement verification, where the word "effective" is 
used to emphasize that the entanglement which might be 
contained in the state pab is destroyed by Alice and Bob 
after their measurements or might not have been present 
at all in PM schemes. To deliver this entanglement proof, 
one can employ any separability criteria 10]. One pos- 
sibility particularly suited for this purpose is the use of 
entanglement witnesses 0, . 

From Ref. 0, we learn that, once the first phase of 
QKD is complete, we need to find quantum-mechanical 
correlations in pij. As it is, the effective entanglement 
verification answers only partially the important ques- 
tion of how much secret key can Alice and Bob obtain 
from their correlated data: it just tells if the secret key 
rate Kg is zero or it may be positive. The problem of 
finding upper bounds for Ks was recently analyzed from 
an entanglement theory point of view by K. Horodecki et 
al. in Ref. These authors showed that the value of 
Ks that can be extracted from a quantum state pab can 
be strictly greater than the distillable entanglement |0| , 
and it is generally bounded from above by the regular- 
ized relative entropy of entanglement E^(pab) 
This upper bound takes only into account the form of 
PAB and assumes perfect detection devices for Alice and 
Bob. To calculate the regularized relative entropy of en- 
tanglement of a given quantum state is, in general, a 
quite difhcult task, and analytical expressions are only 
available for some particular states jU]. Another well- 
known upper bound on A'5 is the so-called intrinsic in- 
formation proposed by Maurer and Wolf (20|. See also 
Refs. (Ill, il^ ilSj . In this case, one can easily incorporate 
the possible imperfections of the detectors in the upper 
bound. However, it requires to solve an infimum ranging 
over the set of all possible discrete probability distribu- 
tions, or discrete channels, which is in principle not easy 
to compute. (See also Ref. jl^.) 

In this paper, we present a simple method to obtain an 
upper bound on Ks that is particularly suited to evalu- 
ate the secret key rate on practical realizations of QKD 
schemes. Moreover, this procedure has the advantage 
that is is straightforward to calculate. It is based on 
the correlated data pij, and it also monitors any form 
of detector imperfections. Specifically, we consider the 
so-called trusted device scenario where Eve cannot mod- 
ify the actual detection devices employed by Alice and 
Bob. We assume that the legitimate users have complete 
knowledge about their detectors, which are fixed by the 
actual experiment. These detectors might be noisy and 
might introduce losses and they are characterized by the 
POVMs {A,} and {Bj}. 

The paper is organized as follows. In Sec. II, we in- 
troduce two desired properties for any upper bound on 
Ks for practical QKD: effective entanglement verifica- 
tion, and the ability to monitor any kind of imperfec- 
tions in Alice's and Bob's detection setups. This section 
contains as well a brief summary of some known upper 



bounds on Ks- Section III includes the main result of 
the paper: There we introduce a straightforward method 
to obtain an upper bound on Ks that satisfies the condi- 
tions presented in Sec. II. This result is then illustrated 
in Sec. IV for two well-known QKD protocols with im- 
perfect detectors: the four-state Q and the six-state 
QKD schemes. Finally, Sec. V concludes the paper with 
a summary. 

II. DESIRED PROPERTIES AND KNOWN 
UPPER BOUNDS ON Ks 

A. Desired properties 

The secret key rate Ks, i.e., the rate of secret key that 
can be obtained per signal state sent by Alice to Bob, 
is one of the most important figures of merit in order to 
compare the performance of different QKD schemes. Ide- 
ally, one would like to calculate the maximum achievable 
value of Ks from the data available once the first phase 
of the QKD protocol is completed. Note that the sec- 
ond phase is just a classical procedure that is completely 
independent of the actual experimental setup used. 

In a similar spirit, any upper bound on the achiev- 
able secret key rate Ks should as well be valid for any 
arbitrary public communication protocol performed dur- 
ing the second phase of QKD. The upper bound only 
depends on the observed data pij together with the par- 
ticular POVMs {A^} and {Bj} used by Alice and Bob. 

This gives rise to one main requirement expected from 
any upper bound on Ks'. if the observed data pij can 
originate from a separable state, then any upper bound 
must vanish That is, the upper bound might be con- 
sidered as the generalization of the necessary effective 
entanglement verification. 

From a practical point of view, it would be necessary 
that any upper bound on Ks includes the effect of im- 
perfect devices. Especially, it should be able to take into 
account the low detection efficiency and the noise in the 
form of dark counts introduced by current detection de- 
vices. This fact is of special importance in order to com- 
pare different realizations of QKD, and it can be used 
to see the tradeoff between desired and realizable imple- 
mentations of QKD. 

B. Known upper bounds on Ks 

In this section, we review very briefly some known up- 
per bounds on Ks that apply to particular scenarios: 

Mutual information I(A;B): Suppose Alice and Bob 
are connected by a public channel and have access to 
repeated independent realizations of two random vari- 
ables, denoted as A and B, and which are character- 
ized by a joint probability distribution pab- An up- 
per bound on the secret key rate Ks is given by the 
mutual information I{A;B) [l^ l20l |. This quantity 
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is defined in terms of the Shannon entropy H{X) = 
— ^^g^ p(a;) logp(a;) and the Shannon joint entropy 
HiX, Y) = - J2xex 'EyeY Pi^^ v) ^ogpix, y) as 



I{A- B) = H{A) + H{B) - H{A, B) 



(2) 



This result is not surprising since the mutual information 
quantifies the reduction in the uncertainty of the random 
variable A because of the knowledge of B. 

This upper bound can directly be used for the case 
of QKD, just by taking as pab the correlated data pij. 
Moreover, in this case, one can easily incorporate the ef- 
fect of the imperfections in the detectors when calculating 
I [A; B). Unfortunately, the mutual information can only 
provide an upper bound on Ks that is not really tight. 

Intrinsic information I{A\B [ E): It provides an up- 
per bound on Ks for a particular classical key-agreement 
scenario. First, we describe the classical situation, and 
afterward, we adapt the upper bound to the QKD sce- 
nario. 

In the classical case, Alice, Bob, and Eve have access to 
independent realizations of three random variables, A, _B, 
and -E, and which are described by the joint probability 
distribution The intrinsic information, denoted as 

I{A;B I E), constitutes an upper bound on the secret 
key rate Kg [20 J . The intrinsic information is defined as 



nA;BiE) 



mi I{A;B\E), 

E^E 



(3) 



where the minimization runs over all possible classical 
channels E E characterized by the transition proba- 
bility Pe\e^ ^^'^ where I{A; B\E) is the mutual informa- 
tion between Alice and Bob given the public announce- 
ment of Eve's data based on the probabilities Pabe- This 
quantity is defined in terms of the conditional Shannon 
entropy H{X\e) = Y.xex -p{x\e)\og2p{x\e) as 



I{A- B\E) = J2 m \H{A\e) + i/(i?|e) - H{A, B\e) 



seE 



The intrinsic information satisfies l2C 



< i^s < I{A;B i E) < I{A;B). 



(4) 



(5) 



That is, I{A; B\E) is a tighter bound on Ks than the mu- 
tual information. However, recently it has been proven 
that the secret key rate can be smaller than the intrinsic 
information [2lLl2^ . 

More important for QKD, the upper bound based on 
the intrinsic information can be adapted to the case 
where Alice, Bob, and Eve start sharing a tripartite 
quantum state instead of a joint probability distribution. 
For this purpose, one can consider all possible tripar- 
tite states that Eve can establish using her eavesdropping 
method, and all possible measurements she could perform 
on her subsystem. This gives rise to a set of possible ex- 
tensions V of the probability distribution Pab to Pabe- 
Now one can define the intrinsic information as |7|| 



I{A]B i E) = inf I{A;B\E) 



(6) 



As in the case of the mutual information, also this 
bound allows us to include the imperfections of the de- 
tection devices when calculating I{A;B j E). More- 
over, it provides effective entanglement verification, i.e., 
I{A; B I E) = if and only if the equivalence class S 
contains a separable state |3, ^3 • Unfortunately, it re- 
quires us to solve an infimum problem that is not easy to 
compute. Note that if the range of the random variable 
E is finite, then the infimum becomes a minimum over 
channels with the same alphabet |l7j. 

Regularized relative entropy of entanglement 
E^{pab): Suppose Alice and Bob share several 
copies of a quantum state pab, and they are allowed to 
perform arbitrary local operations and classical commu- 
nication (LOCC). The regularized relative entropy of 
entanglement E!^{pab) is an upper bound on Ks uM- 
The relative entropy of entanglement Er{pAB) is given 
by [Hill 



-ErCPAs) = inf Tr[/9AB (log PAS - log cr^ep)]- (7) 

where the infimum is taken over all separable states a^p. 
The regularized version of Er{pAB) is given by 0,13- 



•AB, 



= lim 



EApTb) 



(8) 



This quantity depends only on the shared quantum states 
Pab, and therefore it does not include the possible im- 
perfections on the detectors of Alice and Bob. Moreover, 
to calculate the regularized relative entropy of entangle- 
ment of a given quantum state is, in general, a quite dif- 
ficult task, and analytical expressions are only available 
for some particular states 

Intrinsic information of a tripartite quantum state 
I{pabe): Assume Alice, Bob, and Eve share several 
copies of a quantum state pabe, and they are allowed 
to perform arbitrary LOCC and may communicate via a 
public channel. The intrinsic information of the tripartite 
quantum state pabe is defined as [Tsl l 



IipABE)^mf}2piek)SiA;B) 

'''' k 



(9) 



with S{A;B),, ^ Sip^l) + S{p%^) - S{p%)^ being the 
quantum mutual information of the conditional state 
P^AB = TrE{EkPABE)/p{.ek), and represents an upper 
bound on Ks 15]. Here S{p) denotes the von Neu- 
mann entropy of the state p. It is defined as S{p) = 
— Tr(plog2 p). The infimum given in Eq. Q runs over all 
possible POVMs {Ek}. 

This upper bound depends only on the quantum state 
Pabe and its definition does not include the effect of 
possible imperfections in the detectors of Alice and Bob 
in the most general case. 



III. UPPER BOUND ON Ks 



In this section, we introduce a simple procedure, cf. 
Sec, nil D1 to obtain an upper bound on Ks that satisfies 
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the two desired conditions presented in Sec. II. Moreover, 
this procedure has the advantage that it is straightfor- 
ward to calculate. In order to do that, we start by pre- 
senting a naive method which allows the derivation of a 
simple upper bound on Ks- This method is based on im- 
posing a particular eavesdropping strategy by Eve, and 
it guarantees that any resulting upper bound is able to 
monitor possible detector inefficiencies by construction. 
The necessary entanglement verification condition is then 
included as a particular example of this method. This is 
done by selecting a special eavesdropping strategy that 
exploits the best separable approximation (BSA) |2a.l2^ . 



A. Simple method to derive upper bounds on Ks 

The idea is simple: just impose some particular eaves- 
dropping strategy for Eve, and then use one of the al- 
ready known upper bounds. The upper bound obtained 
represents an upper bound for any possible eavesdrop- 
ping strategy. If we use as starting point, for instance, 
the intrinsic information, then the bound would be able 
to include the effect of imperfect detectors. The method 
can be described with the following three steps. 

(1) Select a particular eavesdropping strategy for Eve. 
This strategy is given by the choice of a tripartite quan- 
tum state pABE and a POVM {Ek}- The only restriction 
here is T^t:e{pabe) G S. That is, the chosen strategy can- 
not alter the observed distribution pij . 

(2) Select three random variables A, B, and E with 
probability distribution pij^ — TT{AiBjEk Pabe)- Note 
that the POVMs of Ahce {Ai} and Bob {Bj} are known 
and cannot be modified by Eve. 

(3) Calculate the intrinsic information Ie^.{A\ B I E), 
where the subscript Ek denotes the chosen measure- 
ment strategy for Eve. The secret key rate Ks is upper 
bounded by /b, {A; B [ E). 

Step (3) could also be substituted by an optimization 
taken over all possible measurement strategies performed 
by Eve. That is, one might use as upper bound 

Ks < inf Ie, {A; B i E) ^ inf Ie, {A; B\E). (10) 

Eh Eh 

Moreover, in this last case, it is easy to see that the same 
upper bound could also be obtained from the intrinsic 
information of a tripartite quantum state. The corre- 
sponding steps for this case are included in App. ^ 

This method does not always guarantee effective en- 
tanglement verification, but this depends on the eaves- 
dropping strategy selected in step (1). In Sec. IIII (Jl we 
introduce a special eavesdropping strategy that guaran- 
tees that this property is always satisfied. It is based on 
the use of the BSA of a quantum state |23|. Next, 
we introduce the equivalence between the BSA idea and 
effective entanglement verification. 



B. Best separable approximation and necessary 
entanglement verification 

The best separable approximation (BSA) |23| of 
a given state pab is the decomposition of pab into a 
separable state dsep and an entangled state Pent, while 
maximizing the weight of the separable part. That is, 
given an arbitrary state paBi it can be proven that this 
state can always be written in a unique way as 

Pab = ^max{PAB)cf sep + [1 ^ ^max{p AB)]Pent i (H) 

where the entanglement state pent has no product vectors 
in its range, and the real parameter \max{pAB) > is 
maximal |2g . l27 j . 

Given an equivalence class S of quantum states, one 
defines the maximum weight of separability within the 
equivalence class, A^^^., as 

^fnax = niax{A„ia2;(pAs) | PAB G S} . (12) 

This parameter is related to the task of effective entan- 
glement verification by the following observation. 

Observation 1. Assume that Alice and Bob can per- 
form local measurements with POVM elements Ai and 
Bj , respectively, to obtain the probability distribution of 
the outcomes pij on the distributed quantum state pab ■ 
Then the following two statements are equivalent: (1) 
The correlations pij can originate from a separable state. 
(2) The maximum weight of separability A|^^^ within the 
equivalence class of quantum states S compatible with 
the observed data pij satisfies A;^^^. = 1. 

Proof. If Pij can originate from a separable state, then 
there exists asep such as cTgep G S. Moreover, we have 
that any separable state satisfy Xmax{crsep) = 1. The 
other direction is trivial. ■ 

Let us define Smax as the equivalence class of quantum 
states composed by those states pab G S with maximum 
weight of separability 

Smax = {pab G S I \max{PAB) — A^^^. } . (13) 



C. Eavesdropping strategy 

Eve's eavesdropping strategy is completely character- 
ized by selecting a tripartite quantum state pabe and 
a POVM {Ek}- We consider a pure state pabe — 
\^)ABEi^\ t^^t is a purification of a state pab chosen 
from the equivalence class Smax- 

We can write the separable part asep and the entangled 
part Pent of the BSA of pab as 

<Jsep = ^qi\(l)i)A{^^\'^\f^)B{fi\' (14) 

i 

Pent = ^ Filial) ABi'^il- (1^) 
i 
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The tripartite state \^)jiBE then given by 

i 

E\/(l-^™-)P^I^^)Asl/.-)i=;' (16) 

3 

where the states {\ei) ^, \fj)^} form an orthogonal ba- 
sis on Eve's subsystem. It is important to note that 
in both kinds of QKD schemes, EB schemes and PM 
schemes, Eve can have access to the state \^)abe given 
by Eq. ^ 0. In an EB scheme, this is clear since 
Eve is the one who prepares the state pab and who dis- 
tributes it to Alice and Bob. In the case of PM schemes, 
we need to show additionally that the state l^)^^^; can 
be obtained by Eve by interaction with Bob's system 
only. In the Schmidt decomposition, the state prepared 
by Alice, \ipsource) ab, can be written as \ipsource)AB = 
'^iCi\ui)A\vi)B- Then the Schmidt decomposition of 
\^)abe' with respect to system A and the composite 
system BE, is of the form \^)abe = J2i Ci\ui)A\ei)BE, 
since Ci and \ui)A are fixed by the known reduced den- 
sity matrix pA to the corresponding values of \'ipsource)AB- 
Then one can find a suitable unitary operator Ube such 
that lii/BE = UBE\vi) B |0) E where |0) e is an initial state 
of an auxiliary system. 

As a measurement strategy for Eve, we consider that 
she is restricted to use a special class of measurements. 
This class of measurements can be thought of as a two 
step procedure. 

(1) First, Eve distinguishes contributions coming from 
the separable part and from the entangled part of pab- 
a Sep and Pent, respectively. This corresponds to a pro- 
jection of Eve's subsystem onto the orthogonal subspaces 
n,.ep = |ei>i5(e»| and Tient = J2j l/j)i5(/jl- 

(2) Afterward, she performs a refined measurement on 
each subspace separately. In the separable subspace. Eve 
can obtain complete information, and no secret key can 
be distilled by Alice and Bob This corresponds to 
a projection onto the orthogonal quantum states {|ej)}. 
In the entanglement part. Eve performs a POVM denoted 
as {Fi}. 

We find that Eve's measurement result belongs to the 
separable subspace with probability ^f^ax' ^^'^ therefore. 

With probabihty 1 — A;^^^., Eve's subsystem is in the 
entanglement subspace and Ks might be bigger than 
zero. After the first step of Eve's measurement, the con- 
ditional quantum state of Alice, Bob, and Eve, denoted 
as pTbe = \^ent)ABEi^ent\, corrcspouds to a purifica- 
tion of pent, i.e., 

\'^ent)ABE = YlVPJ\'^^hB\fj)E- (l^) 

3 

Note that both steps can be described as well together 
by the following POVM: {^Lp,^Lt}, with El^^ = 
\ei){ei\ and i?^„j = FiUent- 



In the next section, we provide an upper bound for 
Ks that arises from this special eavesdropping strategy. 
Moreover, as we will see, the upper bound obtained is 
straightforward to calculate. 

D. Resulting upper bound 

Only the entangled part pent which appears in the 
BSA decomposition of a given state pab might allow Al- 
ice and Bob to distill a secret key in the eavesdropping 
strategy proposed in the previous section. Moreover, Eve 
can always find such an eavesdropping strategy for any 
Pab € Smax- This fact motivates the definition of a new 
equivalence class of quantum states S^^^ 

^max = {PentiPAB) \ PAB G S,nax)} , (18) 

where PentifAB) denotes the entangled part in the BSA 
of the state pab- 

Theorem 1. Consider all possible bipartite entan- 
glement states Pent & ^max^ ^^"^ cousidcr all possible 
POVMs {Fi} that Eve could perform on a purification 
\^ ent) ABE '^^ quautum state Pent- This gives rise 
to a set V of tripartite probability distributions Piji — 
Ti{AiBjFi\<^ent) ABEi'^entl), whcrc {A,} and {Bj} rep- 
resent the POVMs measured by Alice and Bob. The 
secret key rate Ks is upper bounded by 

Ks<{l-Xta,)Mr-\A;B\E), (19) 

where I"^'^{A; B\E) represents the classical conditional 
mutual information of three random variables distributed 
accordingly to piji . 

Proof: This proof is straightforward since, by con- 
struction, Eq. (|19|l is an upper bound of the intrinsic 
information defined in Eq. ©. Note that to obtain 
Eq. (fT^ . we assume a particular type of eavesdropping 
for Eve, and in Eq. (O, the infimum is taken over all 
possible eavesdropping strategies. I 

Instead of optimizing over all possible states pab G 
^max and all possible measurements performed by Eve, 
one could also take any state in S^"^^ and calculate the 
infimum of over all possible POVMs {Fi} 

employed by Eve. This fact simplifies the calculation of 
the upper bound on Ks- 

Corollary 1. Given a state pent € S'^^^, the secret key 
rate Ks is upper bounded by 

Ks<{l-\t,,,)iniI'pf{A-B\E), (20) 

Fi 

with /|n"*(j4; _B|i?) being the classical conditional mu- 
tual information calculated on the probability distri- 
bution piji = i:Y[AiB.jFi\^ent) ABEi^&nt\), and where 

ent) ABE dcnOtCS & purification of Pent- 

Proof. Equation (pn|l is an upper bound of Eq. l(T^ . 
Note that in Eq. (|20|l . we take a particular state pent G 
^max J while the infimum in Eq. (|19|l includes all possible 

states Pent e ■ 
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The upper bounds provided by Theorem 1 and Corol- 
lary 1 are easier to calculate than the one based on the 
intrinsic information defined in Eq. © 28]. However, 
they still demand solving a difficult optimization prob- 
lem. Next, we provide a simple upper bound on Ks 
that is straightforward to calculate. Then, in Sec. II VI we 
illustrate the performance of this upper bound for two 
well-known QKD protocols with imp erfect detectors: the 
four-state and the six-state QKD schemes. We 
compare it with the upper bound given by the regular- 
ized relative entropy of entanglement [T]| . 

Corollary 2: The secret key rate Ks is upper bounded 

by 

^s<(l"ALj/™*(A;i?), (21) 

where /'^"'(A; B) denotes the mutual information calcu- 
lated on the probability distribution pij = Tv{AiB j pent) 
with Pent G SZ'L. 

Proof: Equation (|21|l is an upper bound of Eq. (jJOJ, 
i.e., m.iFjf^\A;B\E) < P'^^A-B). Note that Eve 
could always select a POVM with only one element 
Fi = a. In this case, we have If\A] B\E) ^ /™*(A; B). 
■ 

In Sec. IIVI we show that, for qubit-based QKD pro- 
tocols, the upper bound given by Corollary 1 and by 
Corollary 2 coincide. 

The main difficulty when evaluating this last upper 
bound for a particular realization of QKD relies on ob- 
taining Aj^^j. and Pent- This can be solved by apply- 
ing results from relaxation theory of nonconvex problems 
llalMEll- See also Ref. The solution is included 
in App. 121 

The three bounds on Ks obtained in this section sat- 
isfy the two desired properties included in Sec. Ill Al the 
factor 1 — A^jQ^ accounts for effective entanglement veri- 
fication by Observation 1, and the probabilities "Piji and 
Pij reflect possible detector inefficiencies. 



IV. EVALUATION OF THE UPPER BOUND 

In this section, we evaluate the upper bound on Ks 
given by Eq. H21|l for two well-known qubit-based QKD 
protocols with imperfect detectors: the four-state and 
the six-state 18] QKD schemes. We refer here to single- 
photon implementations of the qubit. The state of the 
qubit is described by some degree of freedom in the po- 
larization of the photon. 

We start by describing the detection devices employed 
by Alice and Bob. They are characterized by some noise 
in the form of dark counts which are, to a good approxi- 
mation, independent of the incoming signals, and by their 
detection efficiency r\. 

Dark counts: For simplicity, we assume that only 
Bob's detection device is affected by the presence of dark 
counts. We consider that Alice's detectors are ideal. The 
total dark count probability is denoted as d. A typical 



value for this parameter is d = 10~^. This scenario can 
be modeled by transforming every ideal POVM element 
Bj of Bob into a noisy clement Bj given by 

I3j ^ {l-d)Bj +djlB, (22) 

where the parameters dj satisfy d = J2j d-j ■ 

The effect of the noise can be included in the calcu- 
lation of the upper bound given by Eq. H21|) via the 
classical mutual information I^'^*{A;B). We have that 
I^^*{A;B) > I'^'^*{A;B) simply because the raw data is 
affected by more noise which needs to be corrected. 

It is important to note that the effective entanglement 
verification alone cannot include the noise coming from 
the dark counts of the detectors. In the ideal case, Alice 
and Bob observe outcomes governed by the ideal proba- 
bility distribution pij , which defines the equivalence class 
of quantum states S. In the noisy scenario, on the con- 
trary, Alice and Bob obtain the probability distribution 
Pij = (1 — d)pij + djPi defining an equivalence class S. 
In principle, both probability distributions are different. 
However, in the trusted device scenario, Alice and Bob 
know all the parameters dj. This means that they can 
obtain pij from pij : pij — 1/(1 — d){pij — djPi), and 
where pi — ^jPij |3^ . That is, we obtain S — S: any 
upper bound which only depends on the shared quantum 
state pab provides the same upper bound independently 
of the noise introduced by the detectors. 

Detector efficiency: Detectors are characterized as well 
by their detector efficiency r/j . This effect can be modeled 
by a combination of a beam splitter of transmittance rjj 
and an ideal detector ^3^. A typical value for rjj in cur- 
rent realizations of QKD is approximately 0.15. In order 
to include the losses of the detectors, we can transform 
every POVM element Bj that corresponds to a "click" 
event into 

B, = VjB,. (23) 

Additionally, the event "no click" corresponds to the fol- 
lowing operator: 

Bvac = ~ ^j)^3 + |vac)(vacl. (24) 

j 

where jvac) represents the vacuum state. 

As in the case of dark counts, the effect of the losses is 
incorporated in Eq. 1)2 l|l via the classical mutual informa- 
tion I''"'* {A; B) . For simplicity, we consider that rjj = rj 
for all the detectors. 

In Fig. ^ we illustrated the upper bound given by 
Eq. (|?T|l for the four-state 2\ and the six-state 18] QKD 
schemes. In the case of the four-state EB protocol, Al- 
ice and Bob perform projection measurements onto two 
mutually unbiased bases, say the ones given by the eigen- 
vectors of the two Pauli operators ax and . In the cor- 
responding PM scheme, Alice can use as well the same 
set of measurements but now on a maximally entangled 
state. For the case of the six-state EB protocol, Alice and 
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Channel Error Probability e 



FIG. 1: Upper bound on the secret key rate Ks given 
by Eq. I21II for the four-state (dashed) and the six-state 
(dash-dotted) QKD schemes. The classical correlated data 
Pij is obtained by measuring the quantum state pAB^e) — 
(1 — 2e) I ?/'"'') (i/)"'" 1 -I- el/2, where e is the error probability 
of a depolarizing channel. The two upper lines (dashed and 
dash-dotted) correspond to the ideal case where the total dark 
count probability is d = 0, and the detector efficiency is 77 = 1. 
The two lines below represent the typical case in current real- 
izations of QKD: d = 10~^ and 77 = 0.15. The solid line of the 
graphic represent the upper bound for Ks given by the reg- 
ularized relative entropy of entanglement i?^(pAs(e)). Note 
that we assume an asymmetric basis choice to suppress the 
sifting effect [3^ . 

Bob perform projection measurements onto the eigenvec- 
tors of the three Pauli operators Ox^cfy, and Oz on the 
bipartite qubit states distributed by Eve. In the corre- 
sponding PM scheme Ahce prepares the eigenvectors of 
those operators by performing the same measurements on 
a maximally entangled two-qubit state. Note that here 
we are not using the general approach introduced pre- 
viously, \'4)source) AB = Si \/Pi'l ) A I )s i tO modcl PM 

schemes, since for this protocol it is sufficient to consider 
that the effectively distributed quantum state consists 
only of two qubits. 

We model the transmission channel as a depolarizing 
channel with error probability e. This means that, in 
both protocols, the joint probability distribution is 
obtained by measuring the quantum state 

PAB(e) = (l-2e)|V'+)(V^+| + ^a, (25) 

where the state |7/;+) represents a maximally entangled 
two-qubit state: = l/\/2(|00) + |11)). In Fig. d 

we assume as well that the total dark count probability 
is d — 10"^, and the detector efficiency is 77 = 0.15. 
Moreover, we consider that all detectors have the same 
dark count probability. 

It is important to note that in this simple two- 
qubit scenario, the conditional mutual information 



r^\A;B\E) reduces to 7^"*(A:B): in this case p^^t 
is just a pure entangled state |2y|, i.e., the purification 
|$ent) of the quantum state pent is of the form |$ent) = 
\'^) AB®\'^) E- qubit-based QKD protocols, therefore, 
the upper bound given by Corollary 1 and by Corollary 2 
coincide since infj^, rpf{A;B\E) = r''*{A;B). In order 
to calculate the maximum weight of separability A!^^^, 
and its associated entangled state p^nt which are neces- 
sary to evaluate Eq. H21|l we use the method described in 
Appendix 

Figure ^ includes also a comparison with the upper 
bound on Ks given by the regularized relative entropy 
of entanglement [HI- To calculate E^{pAB{e)), we use 
the results included in Ref. 0|. Despite its simplicity, 
the upper bound given by Eq. (|21|) can provide a tighter 
bound on Ks than the one proposed in Ref. 11], when 
dealing with typical parameter values for imperfect de- 
tectors. It must be mentioned here, however, that the 
bound given by (pABie)) was proposed in a different 
scenario, and the possibility of having noisy and lossy 
detectors was not considered. The results obtained can 
also be compared with the best lower bounds for the tol- 
erable error rate e arising from known security proofs 
[ssf : e = 0.2 for the case of the four-state protocol, and 
e = 0.276 for the six-state protocol. 

V. CONCLUSION 

A necessary precondition for secure quantum key dis- 
tribution (QKD) is that sender and receiver can use their 
available measurement results to prove the presence of 
entanglement in a quantum state that is effectively dis- 
tributed between them. Moreover, this result applies 
both to prepare and measure and entanglement-based 
schemes. 

Unfortunately, this effective entanglement verification 
answers only partially the important question of how 
much secret key can be obtained by Alice and Bob from 
their correlated data: it just tells if the secret key rate is 
zero or it may be positive. 

In this paper, we present a simple method to obtain an 
upper bound on the secret key rate that is particularly 
suited to evaluate practical realizations of QKD schemes. 
It is based on the correlated data, but it also monitors any 
form of detector imperfections. In particular, we consider 
the so-called trusted device scenario, where Eve cannot 
modify the actual detection devices employed by Alice 
and Bob. We assume that the legitimate users have com- 
plete knowledge about their detectors, which are fixed by 
the actual experiment. 
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APPENDIX A: EQUIVALENT METHOD 

In this Appendix, we present an alternative method 
to the one introduced in Sec. IIII Al that provides exactly 
the same upper bound on Kg. It uses the intrinsic in- 
formation of a tripartite quantum state, and it can be 
described with the following steps: 

(1) Select a particular eavesdropping strategy for Eve. 
This strategy is given by the choice of a tripartite quan- 
tum state pABE- The restriction here is Tte^Pabe) G S. 

(2) Compute the so-called ccq state. This state is of 
the form |25|: 

pTbe = Yl \^^)ab{^^\ ® Pe 
where the state is not normalized and it is given by 

p% = TlAB{AiBjPABE)- 

(3) The upper bound on Kg is given by the intrinsic 
information of the tripartite ccq state p'^'be- 

The equivalence of this method and the one introduced 
in Sec. lIII Al can be seen as follows: if the chosen tripartite 
state PABE is the same for both methods and one fixes 
a measurement strategy {Ek} for Eve, then the condi- 
tional quantum mutual information S{A] B)^^ is equal 
to lEk{A-;B\E = Cfc). Note that in this case, the condi- 
tional state becomes p^b'"' = Pio.i,bj\ek)\ij) yiB{ij\. 

APPENDIX B: OBTAINING A^^^ AND p^nt 

Here we use the method proposed in Ref. 323 to ob- 
tain the parameter A^^^. and the density operator pent ■ It 
is based on results from relaxation theory of nonconvex 

Pblems 0, 0, notably the method of Lasserre 
. The central observation in Ref. [s^ is that many 
problems related with entanglement can be cast into 
the form of optimization problems with polynomial con- 
straints of low degree (three or less). The polynomial part 
of the optimization problems is still nonconvex and com- 
putationally expensive to solve. However, one can find 
hierarchies of solutions in a way that each step is a bet- 
ter approximation to the exact solution than the previ- 
ous one. Moreover, each step can be efficiently solved via 
semidefinite programming |87l |. The hierarchy is asymp- 
totically complete, in the sense that the exact solution is 
asympotically attained. 

It is important to note that the method introduced 
in Ref. |32l | is not only meant as a numerical method, 
but each instance of the hierarchy delivers a semidefinite 
program that is accessible with analytical methods. 



Next, we explain how to cast the problem of fin ding 
X^ax ^^'^ Pent into the dcsircd form analyzed in Ref. ■ 

The equivalence class of quantum states S is defined by 
the POVMs {Ai^Bj} and the observed datap^ : pab > 
belongs to S if it satisfies Tr(^i (g) Bjpab) — Pij for all 
The BSA for pab can be written in the following 

way 

PAB = ^min ^ CTsep + Pent (Bl) 
with (Tsep = Xmax{PAB)Osep and pent = [1 - 

Xmax{pAB)\pent- Separable states dsep can be charac- 
terized in terms of product vectors dsep = J^i-^i^ with 
Pi = Pi\4'i) {'^'il f?) To guarantee that the opera- 

tors Pi have the desired product form, they must satisfy 
the following constraints ,32] : 



Tr[Trj(P,)'] - [T^^Pi)? (B2) 
P, > 0, (B3) 

with / = {A,B}. The associated optimisation problem 
can now be written as 

minimize t, 

subject to t > 1 — Tr((7sep), 
PAB > 0, 
Tr{pAB) = 1, 
TT{Ai (g) BjPab) = Pij 

^sep ^ ^ Pi ? 
i 

Tr[Tr/(P,)'] = [Tr(P.)]' V/ = A,B, 
P.>0, 

PAB - dsep > 0, (B4) 

where the parameter t represents the trace of the quan- 
tum state Pent- This polynomial optimization problem 
can be solved with the help of Lasserre's method [23l ■ For 
these calculations, the package GloptiPoly based on 
SeDuMi ^1 is freely available. The package GloptiPoly 
has a number of desirable features, in particular, it pro- 
vides a certificate for global optimality. 

Note that in low dimensional cases (2 ® 2, 2 ® 3) the 
characterization of separable states can be simplified to 
those states dsep > such as a^^, > ji^, where Tp 
is the partial transposition, that is, the transposition 
with respect to one subsystem. The problem given by 
Eq. (jB4|l can be reduced then to one containing only lin- 
ear and semidefinite constraints. Problems of this form 
can be solved very efficiently with standard semidefinite 
programming modules |37j | . 
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